PT-2024-12678 · Ibm · Ibm Aspera Shares

Published 2024-08-09 · Updated 2024-11-08 · CVE-2023-38018

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM Aspera Shares version 1.10.0 PL2

Description The issue arises from the software's failure to invalidate a session after a password change, potentially allowing an authenticated user to impersonate another user on the system. This flaw in user session handling could allow attackers to impersonate any user within the system, posing a substantial security risk.

Recommendations For IBM Aspera Shares version 1.10.0 PL2, consider disabling the user session handling feature until a patch is available. Restrict access to sensitive areas of the system to minimize the risk of exploitation. As a temporary workaround, limit the ability of authenticated users to interact with other user accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-38018

Affected Products

Ibm Aspera Shares

References · 8

• https://ibm.com/support/pages/node/7164325 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38018 · Security Note
• https://twitter.com/iSecurity/status/1822895570991890614 · Twitter Post
• https://twitter.com/SADEWOABDI12/status/1822924485395431740 · Twitter Post
• https://twitter.com/SecurityAid/status/1854676896274899166 · Twitter Post
• https://t.me/cvenotify/92664 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1823009521385590971 · Twitter Post